Analysis of Ad-Targeting

Privacy Policies and Practices

Submitted for the
Federal Trade Commission
“Exploring Privacy” Roundtable Series
December 4, 2009

privacychoice.org
Jim Brock
jim@privacychoice.org
privacychoice.wordpress.com

1
 Overview

Overview PrivacyChoice Background

Ad-targeting companies studied
Methodology

Findings Anonymity
Sharing
Out-of-Bounds
Deletion
Opt-out availability
Flash cookies
Industry oversight
NAI coverage

Conclusions and Disclosure requirements

recommendations Technology requirements
Website requirements

2 privacychoice.org
 Overview

PrivacyChoice Background
Mission To develop and demonstrate technologies to make
consumer online privacy choices understandable and
actionable

For consumers Index of tracking companies present on popular websites

Two-click opt-out wizard
Enables consumers to opt-out completely or selectively from up to
106 networks based on their policy preferences
Browser add-on for Firefox (IE in alpha testing)
Protects and automatically updates opt-out settings (including
Flash cookie control)
TrackerWatcher browser add-on
Shows tracking companies and policies for any page

For websites PrivacyWidget

Free service for any website to automatically deliver enhanced
consumer disclosure and choice. Integrated with add-on to preserve
consumer preferences.

3 privacychoice.org
 Overview

PrivacyWidget
Implements on any website in
minutes with six lines of
Javascript code
Consumer can open from a
link placed in any text, icon or
tab
Lists all targeting networks
present on the webpage
and/or site
Provides company descriptions,
privacy-policy excerpts and
opt-out links
Requires no ad-network
backend changes
Available now for pilot testing

4 privacychoice.org
 Overview

Methodology
Comprehensive database of ad-targeting company policies and practices
173 companies, including ad networks, exchanges and optimization platforms
For each ad-targeting company, the data include:
Tracking domains used
Opt-out cookies and opt-out URLs
Key privacy-policy classifications and excerpts
Utilization of Flash cookies
Policies and opt-out operations are continuously monitored and updated

Database of ad-targeting company presence on top websites

Spider regularly samples pages for presence of ad-targeting companies
Selective weekly sample of most popular pages (based on search engine listings) and
individual pages scanned by 25,000 TrackerWatcher users

5 privacychoice.org
 Overview

Ad-targeting companies studied

[x+1] Akamai CPX Interactive Lucid Media (Clicksense) Rubicon Project
24/7 Real Media AlmondNet Criteo Media6degrees Safecount
33across.com Amazon Associates Dapper mediaforce ScanScout
Accelerator-media AOL Behavioral Targeting (Tacoda)
DataXu MediaMath ShareThis
AOL Sponsored Listings (Quigo)
aCerno (Akamai) Datran Media Mediaplex
ASDAQ (ContextWeb) Shorttail Media
Acxiom (Relevance-X) Demand Media Mediawhiz
Ask.com (askeraser) SMART AdServer
Ad Frontiers Dotomi Microsoft (Atlas Technology)
AudienceScience Snapshots
AdAdvisor (Targus) Batanga Eloqua Microsoft (live.com) SpecificMEDIA
adap.tv Baynote e-planning Mindset Media
Adaptive Ads SpotXchange
beencounter Etology Mpire (Widgetbucks & AdXpose)
Adblade Bizo
Sprout
eType Navegg
AdBrite Blogads Struq
eXelate Media Next Action
Adcentric Blue Lithium Tatto Media
Eyeblaster NexTag
Adconion BlueKai Tealium
Eyeconomy nugg.ad
AddKick BlueStreak Teracent
brand.net Eyewonder OpenX
AddThis TradeDoubler
BridgeTrack Facilitate Digital Optimax (Casale)
addtoany Traffic Marketplace
Brightcove Factor TG Oridian
Adfusion TRAFFIQ
BrightRoll FetchBack otracking.com
Adify (100+ networks) Tremor Media
BTBuckets flashtalking outbrain
adInterax (Yahoo!) Burst Media's adConductor Tribal Fusion (Exponential)
Fox Audience Network OwnerIQ
AdJuggler Channel Intelligence TruEffect (AdLegend)
AdKnowledge Freewheel peer39
CheckM8 Tumri
Admeld Google (DoubleClick) Permuto
Chitika Turn
AdMotion ChoiceStream
gumgum Pointroll
Gunggo Popular Media Unanimis
AdOn Network ClearSight Interactive
Clearspring Hitbox (Omniture) PrecisionClick Undertone Networks
Adotube
adParlor Clickability IAC Advertising Solutions proximic ValueClick (Fastclick)
AdPerfect Clickhype Insight Express Pubmatic Vibrant Media
Adperium Clicksor interCLICK Pulse360 Videoegg
ClipSyndicate interpolls Vizu
AdRoll QuadrantOne
Collarity Invite Media weborama
AdShuffle Quantcast
Collective Media
AdTech Kontera Reinvigorate widgetbox
Commission Junction
Adtegrity Connextra
LifeStreet Media RichRelevance XGraph
Advertising.com (AOL) ContextuAds Lookery Right Media (Yahoo!) Yahoo! Ad Network
Aggregate Knowledge Lotame (CrowdControl) Rocket Fuel YuMe Networks

Includes ad-related networks or platforms that appear to collect or NAI membership in bold
use consumer information for advertising across multiple sites.
6 privacychoice.org
 Findings

Overview PrivacyChoice Background

Ad-targeting companies studied
Methodology

Findings Anonymity
Sharing
Out-of-Bounds
Deletion
Opt-out availability
Flash cookies
Industry oversight
NAI coverage

Conclusions and Disclosure requirements

recommendations Technology requirements
Website requirements

7 privacychoice.org
 Findings

Policies
Not all ad-targeting companies
have consumer privacy policies

Published privacy policy

for consumers
84% (145)

No published privacy policy

for consumers
16% (28)

In many of these cases, companies have a corporate privacy policy that

does not apply to consumers.

8 privacychoice.org
 Findings

Anonymity
Nearly all ad-targeting companies
promise to keep you anonymous

Anonymity confirmed in policy

92% (133)

Anonymity not confirmed

in policy
8% (12)
A company confirms anonymity by stating that they do not collect
personally identifiable information or that they do not associate it with
your activities and interests.

9 privacychoice.org
 Findings

Sharing
Policies of most ad-targeting companies permit
conveyance of anonymous profile information

No information is conveyed
41% (60)

Anonymous profiles information

may be conveyed
55% (80)

Any information may be conveyed

4% (5)

“Convey” does not include sharing with vendors, transfer in in an acquisition, or pursuant to
other legal process. Some policies provide that information is only shared under confidentiality
agreements.
10 privacychoice.org
 Findings

Out-of-Bounds
Relatively few ad networks promise to stay
out of sensitive areas like financial and health

No enumerated exclusions
73% (106)

Enumerated exclusions
27% (39)

NAI members are assumed to be bound by NAI principles for sensitive categories,
even if they have no express statement in their own policy.

11 privacychoice.org
 Findings

Deletion
Relatively few ad-targeting companies tell you
how long they keep the information they collect

No published deletion policy

75% (109)

Published deletion period

12 months or less
13% (19)

Published deletion period

over 12 months
12% (17)

12 privacychoice.org
 Findings

Opt-out availability
Over one-third of ad targeting companies
offer no consumer opt-out

Opt-out available
62% (107)

No opt-out available
38% (66)

13 privacychoice.org
 Findings

Flash cookies
Some ad targeting companies use flash cookies

No known Flash cookies

91% (160)

Known Flash cookies

9% (16)

Based on Flash cookies found on 17 actual user computers.

14 privacychoice.org
 Findings

Tracking domains
Many ad targeting companies use tracking domains that are
different from their principal corporate domain

Using domains other than

principal corporate domain
25% (43)

15 privacychoice.org
 Findings

Industry oversight
Less than one-fifth of all ad targeting companies
are subject to oversight by the NAI or TRUSTe

NAI members TRUSTe certified

14% (25) 13% (23)

16 privacychoice.org
 Findings

NAI coverage
NAI-members represent a minority of all ad targeting
companies present on top traffic websites

4.4
Average number of ad-targeting companies
present per site

2.3 2.1
Average number of Average number of
non-NAI member NAI-member companies
companies present per site present per site

Based on pages sampled on ad-supported websites in the top 500 traffic

networks (ranked by Quantcast.com)

17 privacychoice.org
 Conclusions and recommendations

Overview PrivacyChoice Background

Ad-targeting companies studied
Methodology

Findings Anonymity
Sharing
Out-of-Bounds
Deletion
Opt-out availability
Flash cookies
Industry oversight
NAI coverage

Conclusions and Disclosure requirements

recommendations Technology requirements
Website requirements

18 privacychoice.org
 Conclusions and recommendations

Disclosure requirements
Privacy disclosures from most ad-targeting companies are substantially
incomplete as to data retention and use of sensitive information.
Recommendation: All ad-targeting companies should provide
minimum disclosures across key areas.

Missing and incomplete privacy policies and use of multiple tracking

domains undermine transparency and accountability.
Recommendation: Ad targeting companies should specifically register
the domains they use for tracking and the privacy policies applicable
to those activities. This will enable industry and consumer groups to
create more effective and complete tools to implement consumer
preferences.

19 privacychoice.org
 Conclusions and recommendations

Technology requirements
The wide reach of non-NAI member targeting companies limits the
effectiveness of self-regulatory efforts.
Recommendation: Effective technology solutions for consumers must
encompass all industry participants, whether or not NAI members.
Disclosure and opt-out tools cannot assume voluntary compliance
with best practices.

Technologies used to signify consumer choices (browser cookies) are less

effective than technologies used to track behavior (Flash cookies).
Recommendation: Every ad-targeting company should provide an opt-
out mechanism no less durable than those they use to track behavior.
This principle can apply to Flash cookies as well as to future potential
tracking methods, including technologies such as HTML5.

20 privacychoice.org
 Conclusions and recommendations

Website requirements
Website publishers are not fully considering privacy impacts when they
enable ad targeting on their websites.
Recommendation: Websites employing ad targeting should provide
enhanced disclosure and choice at the webpage and website level.
This supports greater accountability among websites and advertisers
and provides the easiest and most complete user experience.
Separate disclosure directly within ads, while helpful, cannot alone
provide an acceptable consumer experience. In-ad disclosure depends
upon separate interactions for each ad, gives no single view of all
relevant companies and opt-out choices, and does not easily provide
visibility on multiple companies that may be involved in selection of a
single advertisement or all advertisements on a page.

21 privacychoice.org
 privacychoice.org

22